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AMENDMENTS TO THE CLAIMS 



1 . (Currently Amended) A method for mediating event records between a generation layer 
of events and an operation system layer of events in a communications network by means of 
a mediation layer of events, which includes at least one first self-contained component^ of the 
m e diation lay e r and at least one second self-contained component, of th e m e diation lay e r and 
at least one third self-contained component , which first, second, and third self-contained 
components operate op e rates independently of each first compon e nt of th e m e diation 
teye fother , and wherein the mediation layer of events further comprises at least one buffer, 
the method comprisin g passing the event records through a processing chain of the at least 
three self-contained components, starting from one of the first self-contained components, 
then through one of the third self-contained components, and finally through one of the 
second self-contained components, and for said mediating and passing, 

- the method further comprising: 

- collecting the event records from an element of the generation layer of events 

substantially continuously as a stream, by the at l e ast on e first self-contained component 
in the processing chain of th e m e diation lay e r , 

- processing the collected event records substantially continuousl y in the processing chain , 
wherein the step of processing includes: 
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- writing the event records output from each preceding self-contained component in 
the processing chain of th e at l e ast on e first s e lf - contain e d compon e nt into one of 
said at least one buffer ,-and 

— reading said buffer substantially continuously by the subsequent self-contained 
component in the processing chain for 

- reading the event records as input for said subsequent e ach of th e at l e ast on e s e cond 
self-contained component from on e of thesaid at l e ast on e buffer, 

- after reading any of the event records from the buffer by any subsequent self- 
contained component in the processing chain, retaining a copy of said read event 
record in the buffer, and 

— removing the retained copy of the event record from the buffer after successfully 
outputting the event record from the subsequent self-contained component in the 
processing chain, and 

- delivering the processed event records to an element of the operation system layer of 
events substantially continuously as a stream, by the at l e ast on e second self- 
contained component in the processing chain , of th e m e diation lay e r, 

wh e r e in th e e vent r e cords ar e pass e d through at l e ast thr ee self contain e d compon e nts of 
th e m e diation lay e r, starting from on e of th e first s e lf contain e d compon e nts, th e n 
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through at l e ast on e third s e lf - contain e d compon e nt and finally through on e of the 
s e cond s e lf contained compon e nts, 

wh e rein th e st e p of d e liv e ring ev e nt r e cords compris e s 

writing th e e v e nt r e cords output by a pr e ceding s e lf contain e d compon e nt of the 

m e diation lay e r into a buff e r, and 

reading th e buff e r substantially continuously by th e subs e qu e nt s e lf contained 

compon e nt of th e m e diation lay e r, 

wher e in aft e r r e ading an e v e nt r e cord from a buff e r, a copy of th e e v e nt r e cord i s 

r e tain e d in th e buff e r, and remov e d from th e buff e r only aft e r succ e ssfully outputting the 
e vent r e cord from th e r e ading s e lf contain e d compon e nt of th e m e diation lay e r. 

2. (Currently Amended) A method according to claim 1, wherein at least part of the step of 
processing event records is performed by at l e ast the one of the first self-contained 
compon e nt components of the mediation layer. 

3. (Currently Amended) A method according to claim 1, wherein at least part of the step of 
processing event records is performed by at l e ast the one of the second self-contained 
compon e nt components of the mediation layer. 
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4. (Currently Amended) A method according to claim 1, wherein at least part of the step of 
processing event records is performed by at l e ast the one of the third self-contained 
compon e nt components of the mediation layer that operates independently of the other self- 
contained components of the mediation layer. 

5. (Currently Amended) A method according to claim 1, wherein at least two different hosts 
are used such that at least one of the first, second, and third self-contained components of the 
mediation layer runs in a first host, and at least on e of th e oth e r a different one of the first, 
second, and third self-contained components runs in another host. 

6. (Currently Amended) A method according to claim 4, comprising the steps of 

- delivering event records from each of the first self-contained components of the 
mediation layer to the at least one third self-contained component of the mediation layer 
via at least one buffer, and 

- delivering event records from the one of the third self-contained components of the 
mediation layer to the one of the at least one second self-contained compon e nt 
components of the mediation layer via the at least one buffer. 

7-8. (Cancelled) 

9. (Currently Amended) A method according to claim 1, wherein the preceding self- 
contained component of the mediation layer outputs the_event records into the buffer one by 
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one, and the subsequent self-contained component of the mediation layer reads the event 
records from the buffer one by one. 

10. (Currently Amended) A method according to claim 1, wherein the preceding self- 
contained component of the mediation layer outputs the_event records into the buffer grouped 
into small groups of the event records, and the subsequent self-contained component of the 
mediation layer reads the event records from the buffer in small groups of theevent records. 

11. (Currently Amended) A method according to claim 1, wherein at least two separate self- 
contained components of the mediation layer write the event records into a single buffer. 

12. (Currently Amended) A method according to claim 1, wherein at least two separate self- 
contained components of the mediation layer read the_event records into a single buffer. 

13. (Cancelled) 

14. (Previously Presented) A method according to claim 1, wherein the retained event record 
is marked with status information indicating the "under processing" status of the event 
record. 

15. (Previously Presented) A method according to claim 1, comprising the steps of monitoring 
by a monitoring system the operation of the self-contained components of the mediation 
layer and, in case of failure of any of the self-contained components, automatically setting up 
a new self-contained component to replace the failed component. 
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16. (Previously Presented) A method according to claim 1, comprising the steps of 
monitoring by a monitoring system the production capacity of the self-contained components 
of the mediation layer and, in case of insufficient production capacity of any of the self- 
contained components, automatically setting up an auxiliary self-contained component 
parallel to the self-contained component with insufficient production capacity. 

17. (Previously Presented) A method according to claim 1, wherein an auxiliary self- 
contained component is set up to run in a host different to the host in which the self- 
contained component with insufficient production capacity runs. 

18. (Previously Presented) A method according to claim 1, comprising the steps of 

- receiving event records from the step of collecting in a source system format, 

- converting the received event records into a mediation layer format, 

- supplying the collected event records to the step of processing in the mediation layer 
format, 

- receiving the processed event records from the step of processing in the mediation layer 
format, 

- converting the processed event records into an operation system layer format, and 

- supplying the processed event records to the step of delivering in the operation system 
layer format. 
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19. (Previously Presented) A method according to claim 1, wherein the step of processing 
event records comprises at least one of the following: validating and analysing event records, 
enrichment of event records, aggregation and correlation of event records, formatting of 
event records and rating. 

20. (Previously Presented) A method according to claim 1, wherein each of the self- 
contained components operates independently and continuously once started. 

21. (Previously Presented) A method according to claim 1, comprising the steps of 

- stopping the operation of a self-contained component by the self-contained component 
itself, and 

- performing said step of stopping the operation by the self-contained component only if 
instructed so by a manager component of the mediation layer. 

22. (Previously Presented) A method according to claim 1, comprising the steps of 

- providing each of the self-contained components with its own individual settings, and 

- each of the self-contained components functioning according to its own individual 



23. (Original) A method according to claim 22, wherein said individual settings of each of 
the self-contained components include 

- a node base part of the settings, which is identical to the node base parts of the other self- 
contained components within the mediation layer, and 



settings. 
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- a node application part of the settings, which contain custom processing rules and which 
is different to the node application parts of at least most of the other self-contained 
components within the mediation layer. 

24. (Currently Amended) A system for handling event records in a communications network 
between a generation layer of events and an operation system layer of events by means of a 
mediation layer of events , the system comprising: 

- independ e nt nod e compon e nts of a m e diation lay e r at least one first self-contained 
component, at least one second self-contained component, and at least one third self- 
contained component for processing event records, each of the ind e p e nd e nt nod e first, 
second, and third self-contained components having its own settings^ according to which 
th e nod e and each operates independently of other components of the system, at l e ast 
thr ee of the indep e nd e nt nod e first, second, and third self-contained components being 
configured to handle event records in series through a processing chain such that a 
preceding ind e p e nd e nt nod e compon e nt one of the self-contained components writes the 
event records output into a buffer^ and a subsequent ind e pend e nt nod e compon e nt one of 
the self-contained components reads its input substantially continuously from the buffer, 

- at least one node manager component for configuring each of the nede -first, second, and 
third self-contained components, starting up each of the nede -first, second, and third self- 
contained components, monitoring the functioning of each of the node -first, second, and 
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third self-contained components, and stopping each of the nede -first, second, and third 
self-contained components, when required, and 

- a system database for managing all configuration information of each compon e nt of 
the first, second, and third self-contained components, and for storing information on 
handled events, 

- wherein after r e ading an e vent r e cord from a buff e r, a copy of th e e v e nt r e cord is 
r e tain e d in th e buffer, and r e moved from th e buff e r only aft e r succ e ssfully outputting th e 
event record from the reading ind e pend e nt nod e compon e nt of th e m e diation lay e r the 
system is adapted to perform the steps of: 

- collecting the event records from an element of the generation layer of events 
substantially continuously as a stream, by the first self-contained component in the 
processing chain, 

- processing the collected event records substantially continuously in the processing chain, 
wherein the step of processing includes: 

- writing the event records output from each preceding self-contained component in 
the processing chain into one of said at least one buffer, 

- reading said buffer substantially continuously by the subsequent self-contained 
component in the processing chain for reading the event records as input for said 
subsequent self-contained component from the buffer. 
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- after reading any of the event records from the buffer by any subsequent self- 
contained component in the processing chain, retaining a copy of said read event 
record in the buffer, and 

- removing the retained copy of the event record from the buffer after successfully 
outputting the event record from the subsequent self-contained component in the 
processing chain, 

- delivering the processed event records to an element of the operation system layer of 
events substantially continuously as a stream, by the second self-contained 
component in the processing chain . 

25. (Currently Amended) A system according to claim 24, wherein more than one 
ind e pend e nt nod e compon e nt hav e of the first, second, and third self-contained components 
has b een configured to output into a singl e the buffe r, the buffer being a single buffer . 

26. (Currently Amended) A system according to claim 24, wherein more than one 
independent node component have been configured to read its input from a singl e the buffer, 
the buffer being a single buffer . 

27. (Currently Amended) A system according to claim 24, wherein at least two of the 
independ e nt node first, second, and third self-contained components have been configured to 
input, process,, and output the_event records substantially continuously. 
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28. (Currently Amended) A system according to claim 24, comprising a user interface for 
controlling, monitoring,, and configuring the system. 

29. (Currently Amended) A system according to claim 24, wherein the configuration or 
settings of any compon e nt of the first, second, and third self-contained components can be 
changed by a supervisor at any time, without stopping a handling process. 

30. (Currently Amended) A system according to claim 24, wherein the tasks undertaken by 
the node -first, second, and third self-contained components include collecting the events 
records from a communication network, aggregating the event records, converting the event 
records, analyzing the event records, correlating the event records, enriching the event 
records, formatting the event records, rating events and/or delivering the event records. 

31. (Currently Amended) A system according to claim 24, which is configured to process the 
event records in several, simultaneously operating, and at least partly parallel streams. 

32. (Currently Amended) A system according to claim 24, comprising at least two audit trail 
counters for counting auditing values, which are individual quantities of at least two of a 
group of records consisting of: incoming records, rejected records, reprocessed records, 
records residing in a specific nod e compon e n t one of the first, second, and third self- 
contained components , records omitted due to filtering, records expired or deleted, new 
records created due to splitting or duplication, new records generated that are not related to 
input records, input records sent to aggregation/correlation process, records that were merged 
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due to aggregation or correlation, resulting records that were completed and came out from 
the aggregation/correlation process, resulting records that were flushed out from the 
aggregation/correlation process, records left to a sp e cific nod e component the specific one of 
the first, second, and third self-contained components and/or records written out. 

33. (Previously Presented) A system according to claim 24, comprising at least one audit trail 
function for checking that no data is lost within the system. 

34. (Currently Amended) A system according to claim 24, comprising at least one data 
storage component, wherein at least one node compon e nt of the first, second, and third self- 
contained components is configured to write information on all of the events processed by 
the nod e compon e nt at least one of the first, second, and third self-contained components . 

35. (Currently Amended) A system according to claim 24, wherein the node manager 
component is configured to start up a new nod e compon e nt one of the first, second, and third 
self-contained components in case nod e compon e nt another one of the self-contained 
components in the system fails such that the new nod e compon e nt one of the first, second, 
and third self-contained components replaces the function of the failed component in a 
processing chain. 

36. (Currently Amended) A system according to claim 24, wherein the node manager 
component is configured to start up a new nod e compon e nt one of the first, second, and third 
self-contained components parallel to a functioning nod e component one of the first, second. 
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and third self-contained components in case the processing capacity of the system has to be 
raised. 

37. (Currently Amended) A system according to claim 24, wherein each of the nod e first, 
second, and third self-contained components comprise a node base providing basic 
functionality of the^ede - self-contained component and an application containing processing 
rules, according to which the-aede self-contained component processes the event records 
input to the^tede - self-contained component. 

38. (Currently Amended) A system according to claim 37, wherein the node bases of the 
nede -self-contained components are identical to each other. 

39. (Previously Presented) A system according to claim 37, wherein the node base includes 
an input module, an output module, an API module, a configuration module and an audit 
module. 

40. (Currently Amended) A system according to claim 24, wherein the^ede self-contained 
components have been configured to continue their independent operation until instructed 
otherwise by the node manager component. 

41. (Currently Amended) A system according to claim 24, comprising at least two separate 
hosts, each of the hosts running at least one of the ind e p e nd e nt nod e first, second, and third 
components. 
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42. (Currently Amended) A computer program product for a system for handling event 
records in a communications network between a generation layer of events and an operation 
system layer of events, which system comprises ind e p e nd e nt nod e s at least a first self- 
contained component, at least a second self-contained component, and at least a third self- 
contained component of a mediation layer for processing the event records, the computer 
program product comprising: 

- a node base program means capable of providing basic software functionality for the 
ind e p e ndent nodes first, second, and third self-contained components , said basic software 
functionality including an external interface ^ of th e nod e and an internal interface of4he 
nod e each of the self-contained components , 

- an application programming interface means for receiving application programs for the 
indep e nd e nt nodes each of the self-contained components , which application programs 
are capable of interfacing with the internal interfaces of th e nod e each of the self- 
contained components , 

- a node manager program means for setting up at least one node manager that is capable 
of constructing, configuring, starting up, monitoring and stoppin g th e indep e nd e nt nod e s 
each of the self-contained components , and 

- a user interface program means for setting up a user interface for configuring the at least 
one node manager, 

- wherein the system -computer program product is adapted to perform the steps of: 
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- passing the event records through a processing chain of the at least three self-contained 
components, starting from one of the first self-contained components, then through one of 
the third self-contained components, and finally through one of the second self-contained 
components, and for said mediating and passing, 

the method comprises performing the steps of: 

- collecting event records from an element of the generation layer of events substantially , 
continuously as a stream, by the first self-contained component in the processing chain, 

- processing the collected event records substantially continuously in the processing chain, 
wherein the step of processing includes: 

- writing the event records output from each preceding self-contained component in 
the processing chain into one of said at least one buffer, 

- reading said buffer substantially continuously by the subsequent self-contained 
component in the processing chain for reading the event records as input for said 
subsequent self-contained component from the buffer, 

- after reading any of the event records from the buffer by any subsequent self- 
contained component in the processing chain, retaining a copy of said read event 
record in the buffer, and 
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- removing the retained copy of the event record from the buffer after successfully 
outputting the event record from the subsequent self-contained component in the 
processing chain, 

- delivering the processed event records to an element of the operation system layer of 
events substantially continuously as a stream, by the second self-contained component in 
the processing chain. 

pass the e v e nt r e cords through at l e ast thr ee of th e indep e nd e nt nod e s, starting from on e 

of at l e ast on e first ind e p e nd e nt nod e , th e n through at l e ast on e third ind e pend e nt nod e , 
and finally through on e of at l e ast on e s e cond ind e p e nd e nt nod e , 
to writ e th e ev e nt r e cords output by a prec e ding ind e p e nd e nt nod e into a buff e r, and 
to r e ad th e buff e r substantially continuously by a subsequ e nt ind e pend e nt nod e of th e 
m e diation lay e r, 

- wh e r e in aft e r r e ading an e v e nt r e cord from th e buff e r, a copy of th e e v e nt r e cord is 
r e tain e d in th e buff e r, and r e mov e d from th e buff e r only aft e r succ e ssfully outputting th e 
e vent r e cord from th e r e ading ind e p e nd e nt nod e of th e m e diation lay e r. 

43. (Currently Amended) A computer program product according to claim 42, wherein the 
node manager program means include program code means to direct a node manager to 
construct ind e p e nd e nt nod e s the first, second, and third self-contained components by 
combining a copy of node base program means and an application program. 
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44. (Currently Amended) A computer program product according to claim 42, wherein the 
application program contains logical rules according to which of the node -first, second, and 
third self-contained components processes the event records input to one of the nod e first, 
second, and third self-contained components . 

45. (Currently Amended) A computer program product according to claim 42, wherein the 
external interface of the node enables the node -first, second, and third self-contained 
components to communicate with other-^ede s self-contained components and the node 
manager. 

46. (Currently Amended) A computer program product according to claim 42, wherein the 
node manager program means include program code means to direct a node manager, in case 
a nod e one of the first, second, and third self-contained components in the system fails, to 
construct, configure and start up a new node - self-contained component that replaces the 
function of the failed^tede one of the first, second, and third self-contained components . 

47. (Currently Amended) A computer program product according to claim 42, wherein the 
node manager program means include program code means to direct a node manager, in case 
of insufficient production capacity of any of the-iiede s first, second, and third self-contained 
components , to construct, configure and start up a new node -self-contained components 
parallel to the^ede- one of the first, second, and third self-contained components with 
insufficient production capacity. 
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48. (Previously Presented) A computer program product according to claim 42, wherein the 
application programming interface means are capable of supporting several programming 
languages. 

49. (Currently Amended) A computer program product according to claim 42, which is 
capable of configuring the nodes- first second, and third self-contained components to form 
the processing chains chain of serially connected ind e p e nd e nt nod e s self-contained 
components , for processing the event records. 

50. (Currently Amended) A computer program product according to claim 49, which is 
capable of configuring the first, second, and third self-contained components ft edes-in the 
processing chains chain to transfer the event records from a preceding node in the chain to a 
subsequent nede -one of the first, second, and third self-contained components in the chain by 
means-e£a of the buffer. 

51. (Currently Amended) A computer program product according to claim 42, which is 
capable of configuring th e nod e s the first, second, and third self-contained components to 
function continuously and independently until instructed otherwise by the node manager. 

52. (Currently Amended) A computer program product according to claim 42, which 
supports multi-host execution and is capable starting up the first, second, and third self- 
contained components nedes-in different hosts, and configuring the the first, second, and 
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third self-contained components nedes-in different hosts to form processing chains for 



processing the event records. 



